Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add agent field parsing #68

Merged
merged 2 commits into from
Oct 7, 2020
Merged

Add agent field parsing #68

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
def5ec8
Add agent field parsing
Oct 7, 2020
10b5866
Parse Severity from code field
Oct 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion plugins/apache_http.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
version: 0.0.2
version: 0.0.3
title: Apache HTTP Server
description: Log parser for Apache HTTP Server
parameters:
Expand Down Expand Up @@ -55,6 +55,32 @@ pipeline:
timestamp:
parse_from: time
layout: '%d/%b/%Y:%H:%M:%S %z'
output: access_agent_router
severity:
parse_from: code
preset: none
preserve: true
mapping:
info: 2xx
notice: 3xx
warning: 4xx
error: 5xx

# Router to determine if agent field can be parsed.
- id: access_agent_router
type: router
routes:
- expr: '$record.agent != nil and $record.agent matches "^(?P<client>[^/]*)/(?P<client_version>[^ ]*) (\\((?P<system>[^;]*);([^\\)]*)\\))?(.*)?"'
output: access_agent_parser
- expr: true
output: {{ .output }}

# Parse agent field
- id: access_agent_parser
type: regex_parser
regex: '^(?P<client>[^/]*)/(?P<client_version>[^ ]*) (\((?P<system>[^;]*);([^\)]*)\))?(.*)?'
parse_from: $record.agent
preserve: true
output: {{ .output }}
#{{ end }}

Expand Down